Add security auto remediation MVP

.gitignore

@@ -1,5 +1,6 @@
 # Binaries
 devsecops
+devsecops.exe
 devsecops-*
 !demo/devsecops-*
 

Makefile

@@ -1,13 +1,16 @@
 # Makefile
 
 MODULE_PATH := github.com/edgarpsda/devsecops-kit
-VERSION ?= 0.4.1
+VERSION ?= $(shell git describe --tags --always 2>/dev/null || echo development)
+COMMIT ?= $(shell git rev-parse --short HEAD 2>/dev/null || echo none)
+DATE ?= $(shell date -u +"%Y-%m-%dT%H:%M:%SZ")
+LDFLAGS := -X $(MODULE_PATH)/cli/cmd.version=$(VERSION) -X $(MODULE_PATH)/cli/cmd.commit=$(COMMIT) -X $(MODULE_PATH)/cli/cmd.date=$(DATE)
 
 BINARY_NAME := devsecops
 
 .PHONY: build
 build:
-	go build -ldflags "-X $(MODULE_PATH)/cli/cmd.version=$(VERSION)" -o $(BINARY_NAME) ./cmd/devsecops
+	go build -buildvcs=false -ldflags "$(LDFLAGS)" -o $(BINARY_NAME) ./cmd/devsecops
 
 .PHONY: test
 test:
@@ -20,8 +23,8 @@ lint:
 # Cross-compilation examples for releases
 .PHONY: build-linux-amd64
 build-linux-amd64:
-	GOOS=linux GOARCH=amd64 go build -ldflags "-X $(MODULE_PATH)/cli/cmd.version=$(VERSION)" -o $(BINARY_NAME)-linux-amd64 ./cmd/devsecops
+	GOOS=linux GOARCH=amd64 go build -buildvcs=false -ldflags "$(LDFLAGS)" -o $(BINARY_NAME)-linux-amd64 ./cmd/devsecops
 
 .PHONY: build-darwin-arm64
 build-darwin-arm64:
-	GOOS=darwin GOARCH=arm64 go build -ldflags "-X $(MODULE_PATH)/cli/cmd.version=$(VERSION)" -o $(BINARY_NAME)-darwin-arm64 ./cmd/devsecops
+	GOOS=darwin GOARCH=arm64 go build -buildvcs=false -ldflags "$(LDFLAGS)" -o $(BINARY_NAME)-darwin-arm64 ./cmd/devsecops

README.md

@@ -170,6 +170,28 @@ cd devsecops-kit
 go build -o devsecops ./cmd/devsecops/
 ```
 
+For release-style builds, inject Git metadata with ldflags:
+
+```bash
+go build -buildvcs=false -ldflags "\
+  -X github.com/edgarpsda/devsecops-kit/cli/cmd.version=$(git describe --tags --always) \
+  -X github.com/edgarpsda/devsecops-kit/cli/cmd.commit=$(git rev-parse --short HEAD) \
+  -X github.com/edgarpsda/devsecops-kit/cli/cmd.date=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+  -o devsecops ./cmd/devsecops/
+```
+
+Or use the included build helpers:
+
+```bash
+make build
+```
+
+On Windows PowerShell:
+
+```powershell
+.\build.ps1
+```
+
 ### Scanner dependencies
 
 The CLI orchestrates external tools that must be installed separately:
@@ -180,6 +202,7 @@ The CLI orchestrates external tools that must be installed separately:
 | Gitleaks | [releases page](https://github.com/gitleaks/gitleaks/releases) |
 | Trivy | [install script](https://aquasecurity.github.io/trivy/latest/getting-started/installation/) |
 | Checkov | `pip install checkov` (optional) |
+| Snyk | [Snyk CLI](https://docs.snyk.io/snyk-cli/install-or-update-the-snyk-cli) (optional, for auto remediation) |
 | Ollama | [ollama.com](https://ollama.com) (optional, for AI suggestions) |
 
 Run `devsecops diagnose` to check which tools are available.
@@ -209,7 +232,7 @@ devsecops diagnose
 | **0.4.1** | HTML reports, progress UI | ✅ Released |
 | **0.5.0** | Python/Java detection, SBOM, SARIF output, license compliance | ✅ Released |
 | **0.6.0** | Multi-CI (GitLab/Bitbucket), IaC scanning (Checkov), AI fix suggestions | ✅ Released |
-| **0.7.0** | Vulnerability trending, EPSS/KEV scoring, TruffleHog integration | 📋 Planned |
+| **0.7.0** | Security Auto Remediation MVP, Snyk remediation provider, Semgrep hardening, Git metadata builds | ✅ Released |
 
 ## Contributing
 

build.ps1

@@ -0,0 +1,34 @@
+$ErrorActionPreference = "Stop"
+
+$modulePath = "github.com/edgarpsda/devsecops-kit"
+$repoRoot = (Get-Location).Path.Replace("\", "/")
+
+function Get-GitValue {
+    param (
+        [string[]]$Arguments,
+        [string]$Fallback
+    )
+
+    try {
+        $value = & git -c "safe.directory=$repoRoot" @Arguments 2>$null
+        if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($value)) {
+            return $Fallback
+        }
+        return $value.Trim()
+    } catch {
+        return $Fallback
+    }
+}
+
+$version = Get-GitValue -Arguments @("describe", "--tags", "--always") -Fallback "development"
+$commit = Get-GitValue -Arguments @("rev-parse", "--short", "HEAD") -Fallback "none"
+$date = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
+
+$ldflags = "-X $modulePath/cli/cmd.version=$version -X $modulePath/cli/cmd.commit=$commit -X $modulePath/cli/cmd.date=$date"
+
+Write-Host "Building DevSecOps Kit"
+Write-Host "Version: $version"
+Write-Host "Commit : $commit"
+Write-Host "Built  : $date"
+
+go build -buildvcs=false -ldflags $ldflags -o devsecops.exe ./cmd/devsecops

cli/ai/suggestions.go

@@ -83,9 +83,17 @@ func (c *Client) EnrichFindings(findings []scanners.Finding) {
 	}
 }
 
+// Complete sends a prompt to the configured AI provider and returns the raw response.
+func (c *Client) Complete(prompt string) (string, error) {
+	return c.complete(prompt)
+}
+
 func (c *Client) getSuggestion(f *scanners.Finding) (string, error) {
 	prompt := buildPrompt(f)
+	return c.complete(prompt)
+}
 
+func (c *Client) complete(prompt string) (string, error) {
 	switch c.cfg.Provider {
 	case "openai":
 		return c.callOpenAI(prompt)